At two in the morning, the IT admin of a clinic in Bandar Lampung gets a notification: the admin account for the medical records system is logging in from another country. He is certain he is not logging in. Within minutes, he cuts off access, changes the password, and only breathes easier when the system shows all data remains safe. The investigation reveals his old password leaked from a data breach of another service he used years ago. The only reason the attacker failed to get in: the account used two-factor authentication, and access was only allowed from specific devices and locations.
That clinic, without realizing it, had already been applying a little of the zero trust philosophy.
Zero trust is not a product you can buy; it is a way of thinking about security that is reshaping how organizations worldwide protect their data. Its philosophy is simple and brutal: never trust, always verify. Nothing is trusted automatically just because it sits inside the office network. Every access request, from anyone and to anything, must be proven first.
This article explains what zero trust is, why the old security model no longer suffices, its core principles, and how businesses in Indonesia can adopt it gradually without overhauling everything at once.
Why the "Castle" Model Is No Longer Enough
For decades, network security worked like a medieval fortress. Everyone and every device inside the office walls was considered trusted; everything outside was considered a threat. This is where firewalls, antivirus, and detection systems were placed. Once someone got inside, they could move freely anywhere.
This model rests on one assumption that has now collapsed: that "inside" means safe.
The collapse happened for several big reasons. Employees no longer work only from the office; they access systems from home, coffee shops, and hotels. Data no longer lives only on office servers; it is spread across cloud services run by third parties. Personal devices are used for work. And most decisive: modern attackers no longer bother breaching the fortress from outside. They steal employee credentials and walk in through the front door dressed as insiders.
Every layer of defense behind the walls becomes useless when the person passing through is an attacker disguised as an employee. Data from Indonesia's National Cyber and Crypto Agency (BSSN) shows thousands of cyber incidents reported in Indonesia every year, many of them starting from stolen or abused credentials. Once attackers hold a legitimate account, the castle model gives them full freedom of movement.
Zero trust was born to answer exactly this weakness.
What Zero Trust Actually Is
Zero trust is a security principle stating that no user, device, or network is trusted automatically, including those already inside. Every access to every resource must be verified continuously based on identity, device, and the context of the request.
The term grew from the "paranoid network" concept proposed in 2010 and exploded after major breaches proved the perimeter model failing. The concept is often summarized in three words: never trust, always verify.
One thing must be clarified from the start: zero trust is not a product. Many vendors sell "zero trust solutions," but what they sell are components of this architecture. Zero trust is a mindset and a set of principles that determine how you design access, identity, and network. It can be implemented with a range of tools, from cheap to very expensive.
A common misunderstanding: zero trust means making life harder for employees. In fact, applied well, access can become easier for the right users, because verification happens automatically in the background, while suspicious requests are blocked at the door.
The Three Core Principles of Zero Trust
The entire zero trust architecture stands on three principles that reinforce each other.
1. Treat Every Access Request the Same
There is no difference in treatment between a request from inside the office and one from outside. A login request from an apparently legitimate internal network still goes through identity verification exactly as strict as access from abroad. This completely reverses the castle model's assumption: location is no longer a reason to be trusted.
2. Grant the Least Access Needed
Every user and device is given only the permissions needed to do their job, nothing more. Warehouse staff do not need access to the finance module. An intern does not need to see the entire customer database. This principle, called least privilege, ensures that one compromised account does not automatically open the entire system.
3. Verify Continuously, Not Once
Logging in once and being free all day is an old habit that must stop. Zero trust keeps checking: does this request come from a registered device? Is the behavior normal? If there is an anomaly, access is revoked or re-verification is requested, even in the middle of an active session.
Core Components of a Zero Trust Architecture
To translate principles into practice, several components are usually built together.
Identity and Access Management (IAM)
IAM is the foundation of zero trust. It manages who the users are, what roles they have, and what they are allowed to access. This includes single sign-on (one login for many applications), role management, and the account lifecycle: the accounts of employees who leave must be deactivated immediately, not left dormant for years.
Multi-Factor Authentication (MFA)
MFA requires more than one proof of identity: something you know (password), something you have (phone or token), something you are (biometrics). MFA is the layer with the best cost-benefit ratio in modern security. Studies consistently show that MFA blocks the large majority of attacks using stolen credentials.
Device Management
Every device accessing your systems must be known: registered, encrypted, and meeting basic security policies. Unknown or non-compliant devices get restricted access, or are limited to certain applications rather than the whole network.
Micro-Segmentation
The network is divided into small segments. Communication between segments is strictly limited, so an attacker who gets into one segment cannot hop freely to another. Think of a ship with its watertight doors closed: a leak in one compartment does not sink the whole ship.
Policy Engine and Monitoring
Access decisions are made by a policy engine that weighs context: who, what device, from where, at what time, and what data is being requested. All activity is logged and monitored to detect anomalies. The more context data available, the smarter the decisions it can make.
Myths That Make Businesses Postpone
Before discussing implementation steps, let us dismantle the myths that most often make business owners postpone zero trust.
"Zero trust is only for large companies"
This is wrong. The principle actually makes the most sense for small and medium businesses, because they are more vulnerable: small IT teams, limited resources, and a single incident can destroy the business. Many zero trust components can start with tools the company already has, such as MFA on Google Workspace or Microsoft 365.
"Zero trust is expensive"
Enterprise-grade zero trust products do cost a lot. But a phased implementation can start with small costs: enable MFA, apply role-based access policies, run regular account audits. The biggest cost actually appears when an incident happens without protection.
"Zero trust makes life harder for employees"
If implemented carelessly, yes. But good practice removes friction instead: single sign-on means employees log in once, not ten times; automated verification runs unnoticed. What changes is that employees need to understand why an extra verification step is sometimes requested.
"If we are on the cloud, we are already zero trust"
Using the cloud is only the first step. Zero trust means configuring access to that cloud correctly: who is allowed in, from what devices, with what verification. A cloud without strict access policies is just as vulnerable as an old server.
A Phased Implementation Roadmap for Indonesian Businesses
Zero trust does not have to be installed overnight. A healthy implementation is always gradual, starting from the highest-risk areas. Here is a realistic roadmap for small and medium businesses.
Phase 1: Know Your Assets and Access
Before securing anything, you need to know what you have. Make a list of all systems: email, financial applications, CRM, operational systems, customer data. For each one, note who has access and how that access is granted. The results are often surprising: accounts of former employees still active, admin access held by many people, or forgotten cloud services.
Phase 2: Require MFA on All Important Accounts
This is the step with the biggest impact and the smallest cost. Enable MFA on email, financial applications, and all systems holding sensitive data. Start with the highest-privilege accounts: owners, directors, and admins. Google Workspace, Microsoft 365, and almost all modern services provide MFA for free.
Phase 3: Apply Role-Based Access
Clean up the access list: remove accounts of people who left, revoke unnecessary admin rights, and define standard work roles. Sales staff get CRM access for their job; finance staff get payment system access; nobody gets "access to everything" without a reason. This policy can be run manually or with consultant help if the systems are complex. Our article on IT consulting discusses when professional help is needed.
Phase 4: Manage Work Devices
Set a device policy: office devices must be locked with a PIN or biometrics, encrypted, and running security updates. Personal devices used for work can be allowed with conditions, or limited to email only, as long as the policy is clear and enforced consistently.
Phase 5: Build Segmentation and Monitoring Gradually
For businesses with larger infrastructure, start separating networks and limiting communication between departments. Enable activity logging and review logs regularly. Many cloud services provide security dashboards showing login activity and anomaly alerts; make sure someone is responsible for monitoring them.
Each phase has its own duration and cost. A small business can finish phases 1-3 within weeks at almost zero cost. A mid-sized business with complex infrastructure may need several months, and that is normal.
Zero Trust in the Cloud: Closing the Most Exploited Gap
One area attackers exploit most is loose cloud configuration. Billions of records of business data in Indonesia have been affected by breaches that started with a poorly secured cloud account.
In the zero trust model, cloud access is strictly governed:
- Every login requires MFA, without exception.
- Access between cloud services uses short-lived temporary credentials, not permanent keys that can sit for years (often in files accidentally uploaded to public repositories).
- Data is labeled by sensitivity, and access to sensitive data is logged and supervised.
- Location policies: logins from unusual countries are rejected immediately or require additional verification.
For businesses currently migrating to the cloud, this is the ideal time to build access policies from the start, instead of patching them on later. Securing the cloud from day one is far cheaper than re-architecting it after an incident.
Measuring the Success of Zero Trust Implementation
How do you know the effort is working? Do not measure by a feeling of safety, but by operational evidence:
- Response time to anomalies. How fast does your team learn about and act on suspicious logins? A healthy target: minutes, not days.
- Number of accounts with excessive rights. The fewer, the better. Regular audits should show a shrinking list, not a growing one.
- MFA coverage. The percentage of important accounts using MFA. Target: 100 percent.
- Simulation results. Phishing tests and attack scenario drills give a real picture of team behavior, far more honest than policy documents.
- Incident recovery time. If an incident occurs, how quickly is access revoked and systems secured?
An important note: zero trust is not a one-time project. It is an ongoing process. New practices, new devices, and new employees keep arriving; policies should be reviewed at least every few months.
Realistic Costs of Adopting Zero Trust in Indonesia
The fair question: how much does it cost? Here are estimates for the Indonesian market.
- Basic phase (Rp 0-500 thousand per month). MFA, role-based access policies, manual account audits. Mostly using features already included in the services you subscribe to.
- Intermediate phase (Rp 1-5 million per month). Device management, single sign-on, centralized activity logging, and team training. Usually subscription services that scale with user count.
- Advanced phase (Rp 5-30 million per month). Network segmentation, automated policy engines, 24-hour monitoring, and incident response support. Relevant for businesses processing large transactions or holding high volumes of sensitive data.
Beyond subscriptions, there is implementation cost: consultants or technical teams to configure, test, and train. For mid-sized businesses, a phased implementation typically lands in the tens of millions of rupiah, far less than the loss from one incident.
The comparison is simple: the average cost of a data breach for a small business is often counted in tens of millions of rupiah, before counting lost customer trust. A single incident can pay for years of protection.
Common Mistakes to Avoid
Several recurring mistakes make zero trust implementation fail or stall:
- Buying products before defining policy. Tools without clear access rules are just expensive decorations.
- Rolling out everything at once. A total overhaul often stalls halfway and frustrates the team. Gradual always lasts longer.
- Forgetting third-party accounts. Vendors, partners, and former employees often still hold access. Audits cover everyone, not just active employees.
- Not training employees. Without understanding, good policies are resisted or bypassed. Employees need to know why verification is requested, and that it protects them too.
- Stopping after installation. A zero trust system that is not reviewed will decay like an unmaintained fortress.
One more trap deserves attention: treating zero trust as a purely technical project. Technology can enforce policies, but the human side determines whether they hold. A small business that skips documentation, forgets to brief new hires, or lets one senior employee keep a shared password will quietly erode even a well-designed architecture. This is why the most durable implementations pair technical controls with simple, visible commitments: a written access policy, a named person responsible for reviews, and a standing agenda item for security in every team meeting. The technical layers stop attackers; the human habits stop the decay.
Zero Trust Starts with One Decision
Back to the clinic IT admin from the opening story. He did not buy an expensive product to get there. He started with small decisions years earlier: enabling MFA, limiting admin access, and rejecting the habit of "one password for everything." When the critical moment came, those small decisions were what worked.
Zero trust often feels abstract until translated into daily actions: verification that cannot be skipped, access limited by role, devices that are recognized, logs that are monitored. Nothing is spectacular, and that is where its strength lies.
Start with the simplest things: enable MFA on all important accounts, clean up the access list, and schedule a monthly account audit. If your infrastructure is already complex and you are unsure where to begin, the Kartech team in Bandar Lampung can help map your systems and build a gradual, realistic zero trust roadmap. From identity and access to network segmentation, we guide you according to your business scale. Discuss it through our contact page or explore our services.
Security is not about trusting more; it is about verifying intelligently. Zero trust teaches one simple lesson: in the digital world, trust is something to be proven, not given.
